ThreatFox: Kuiper IOCs

Hunt Hypothesis

This hunt detects adversary activity by correlating Azure Sentinel logs against 24 specific Indicators of Compromise (IOCs) identified in the ThreatFox Kuiper threat feed to identify known malicious infrastructure. Proactively hunting for these IOCs is critical because it enables the SOC team to rapidly uncover early-stage compromises from this active campaign before they escalate into widespread incidents within the Azure environment.

IOC Summary

Malware Family: Kuiper Total IOCs: 24 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	56160fa06b16e3822879e77aa47f0764	payload	2026-08-15	95%
sha256_hash	dc33f06c86f021af72cc89e1feafa16dad624d43a79242ab738518480a0aef88	payload	2026-08-15	95%
sha1_hash	6e6db8bfff48fb23ca12b33a4c0272d787633e06	payload	2026-08-15	95%
sha1_hash	9d54fa92c215c6ae6eb7b238ba640c10d9ae2c2c	payload	2026-08-15	95%
md5_hash	b3fabcc24d9c8b12a02126d2102a48f9	payload	2026-08-15	95%
sha256_hash	8daa6c064b47a03c85bc0eff732da07e0e8966cfc69771e3b9597cad9a155b13	payload	2026-08-15	95%
md5_hash	d9e1f05c2fef02d320bc2b6aa901f4fd	payload	2026-08-15	95%
sha256_hash	ed6a55a28e22520219c90adeb569c114ab8f01f1e1f2674e06615fe046e7a291	payload	2026-08-15	95%
sha1_hash	f24465bbae171b3b2dadc5403cac20e6a22bb7b3	payload	2026-08-15	95%
sha1_hash	de1efd1c7a44c5fd268cba68dd9ad9fbc4587536	payload	2026-08-15	95%
md5_hash	762792354f7114f7de7420b0c2d77912	payload	2026-08-15	95%
sha256_hash	2b5994f3a89f4efb1fc1459059b0b74c4935cb587981caeaae14598582058368	payload	2026-08-15	95%
sha256_hash	5316c1faefa33328e593d3cf4d54d6e25d7243862d65a67189f76d8b38a682ea	payload	2026-08-15	95%
sha1_hash	5808b595afc8bd757d53cb4f097fdc7e5608eb47	payload	2026-08-15	95%
md5_hash	ed659ff4e9c2f5dca9866645cc7e8b50	payload	2026-08-15	95%
sha1_hash	ac9b909f8218706e0f9002303bed9c8961f5fe3a	payload	2026-08-15	95%
md5_hash	1d84d94f80c74358c7bb2d2794f9c452	payload	2026-08-15	95%
sha256_hash	35491352181d7598270320d15f331f250c848f94b09ce008d78d901b2b5950e0	payload	2026-08-15	95%
sha256_hash	2ba0d4a1d245911c3c1d6de462e6d43748cb855c5e43191ddb44e57f0e556c7b	payload	2026-08-15	95%
sha1_hash	08246c5389f6b61d4f2ada3d22671569f9737817	payload	2026-08-15	95%
md5_hash	5bda45afc655e7c53a12fae62333d9d2	payload	2026-08-15	95%
md5_hash	00c6c592b1ecb9f1e73d6d458f001d09	payload	2026-08-15	95%
sha256_hash	d723ccbf086fa299a5513d2f5ebdbb8206cfbd2d034441db1809fdbc7afe3f70	payload	2026-08-15	95%
sha1_hash	ec7fdc8ec0d72c705ca014a51dd5360c5c6b07cb	payload	2026-08-15	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - Kuiper
let malicious_hashes = dynamic(["56160fa06b16e3822879e77aa47f0764", "dc33f06c86f021af72cc89e1feafa16dad624d43a79242ab738518480a0aef88", "6e6db8bfff48fb23ca12b33a4c0272d787633e06", "9d54fa92c215c6ae6eb7b238ba640c10d9ae2c2c", "b3fabcc24d9c8b12a02126d2102a48f9", "8daa6c064b47a03c85bc0eff732da07e0e8966cfc69771e3b9597cad9a155b13", "d9e1f05c2fef02d320bc2b6aa901f4fd", "ed6a55a28e22520219c90adeb569c114ab8f01f1e1f2674e06615fe046e7a291", "f24465bbae171b3b2dadc5403cac20e6a22bb7b3", "de1efd1c7a44c5fd268cba68dd9ad9fbc4587536", "762792354f7114f7de7420b0c2d77912", "2b5994f3a89f4efb1fc1459059b0b74c4935cb587981caeaae14598582058368", "5316c1faefa33328e593d3cf4d54d6e25d7243862d65a67189f76d8b38a682ea", "5808b595afc8bd757d53cb4f097fdc7e5608eb47", "ed659ff4e9c2f5dca9866645cc7e8b50", "ac9b909f8218706e0f9002303bed9c8961f5fe3a", "1d84d94f80c74358c7bb2d2794f9c452", "35491352181d7598270320d15f331f250c848f94b09ce008d78d901b2b5950e0", "2ba0d4a1d245911c3c1d6de462e6d43748cb855c5e43191ddb44e57f0e556c7b", "08246c5389f6b61d4f2ada3d22671569f9737817", "5bda45afc655e7c53a12fae62333d9d2", "00c6c592b1ecb9f1e73d6d458f001d09", "d723ccbf086fa299a5513d2f5ebdbb8206cfbd2d034441db1809fdbc7afe3f70", "ec7fdc8ec0d72c705ca014a51dd5360c5c6b07cb"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
DeviceFileEvents	Ensure this data connector is enabled

References

• ThreatFox — Kuiper

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: Kuiper IOCs detection rule, including tailored filters and exclusions suitable for an enterprise environment:

• Scenario: Automated Threat Intelligence Feed Ingestion by SIEM

  • Context: Enterprise Security Information and Event Management (SIEM) platforms like Splunk or Microsoft Sentinel often ingest external threat feeds. If the internal threat intelligence module pulls data from a source that shares IOCs with the Kuiper feed, the ingestion process itself may trigger alerts against its own database entries.
  • Filter/Exclusion: Exclude traffic originating from the SIEM’s dedicated ingestion service account (e.g., svc-siem-ingest) or filter logs where the source IP belongs to the internal threat intelligence server range (e.g., 10.20.50.x).

• Scenario: Scheduled Endpoint Protection Scans

  • Context: During nightly maintenance windows, endpoint protection suites such as CrowdStrike Falcon, Carbon Black, or Microsoft Defender for Endpoint perform scheduled updates and signature synchronizations. These agents often query external threat intelligence repositories that overlap with the Kuiper IOC set, generating network connections to known IOCs.
  • Filter/Exclusion: Create a time-based exclusion window (e.g., 02:00–04:00 local time) for processes matching C:\Program Files\CrowdStrike\FalconSensor.exe or MsMpEng.exe. Alternatively, exclude alerts where the process command line contains keywords like “update” or “sync”.

• Scenario: Admin-Driven Vulnerability Scanning

  • Context: Security administrators frequently run vulnerability assessments using tools like Tenable Nessus, Qualys, or Rapid7 InsightVM. These scanners actively probe external hosts and may initiate connections to the specific